Skip to content

Commit baeda8b

Browse files
RyanJonesMXRyanJones08
RyanJonesMX
authored and
RyanJones08
committed
feat: 🎸 Vault TLS
Add vault tls for connections
1 parent 7d7af9a commit baeda8b

File tree

6 files changed

+115
-36
lines changed

6 files changed

+115
-36
lines changed

‎encryption-service-vault/src/main/java/com/mx/path/service/facility/security/vault/VaultEncryptionService.java‎

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import lombok.Getter;
1212
import lombok.Setter;
1313

14+
import com.bettercloud.vault.SslConfig;
1415
import com.bettercloud.vault.Vault;
1516
import com.bettercloud.vault.VaultConfig;
1617
import com.bettercloud.vault.VaultException;
@@ -134,21 +135,42 @@ public final void rotateKeys() {
134135
*/
135136
final Vault buildVaultDriver(@Nullable String authToken) {
136137
try {
137-
VaultConfig vaultConfig = new VaultConfig()
138-
.token(authToken)
139-
.engineVersion(configuration.getEngineVersion())
140-
.address(configuration.getUri())
141-
.build();
142-
143-
Vault newDriver = new Vault(vaultConfig);
144-
145-
if (configuration.getMaxRetries() > 0) {
146-
newDriver.withRetries(
147-
configuration.getMaxRetries(),
148-
Math.toIntExact(configuration.getRetryInterval().toMillis()));
149-
}
138+
if (configuration.isSsl()) { // If SSL is enabled, set up the SSL configuration
139+
SslConfig sslConfig = new SslConfig();
140+
sslConfig.verify(false);
141+
VaultConfig vaultConfig = new VaultConfig()
142+
.sslConfig(sslConfig)
143+
.token(authToken)
144+
.engineVersion(configuration.getEngineVersion())
145+
.address(configuration.getUri())
146+
.build();
147+
148+
Vault newDriver = new Vault(vaultConfig);
149+
150+
if (configuration.getMaxRetries() > 0) {
151+
newDriver.withRetries(
152+
configuration.getMaxRetries(),
153+
Math.toIntExact(configuration.getRetryInterval().toMillis()));
154+
}
155+
156+
return newDriver;
157+
} else {
158+
VaultConfig vaultConfig = new VaultConfig()
159+
.token(authToken)
160+
.engineVersion(getConfiguration().getEngineVersion())
161+
.address(getConfiguration().getUri())
162+
.build();
163+
164+
Vault newDriver = new Vault(vaultConfig);
165+
166+
if (getConfiguration().getMaxRetries() > 0) {
167+
newDriver.withRetries(
168+
getConfiguration().getMaxRetries(),
169+
Math.toIntExact(getConfiguration().getRetryInterval().toMillis()));
170+
}
150171

151-
return newDriver;
172+
return newDriver;
173+
}
152174
} catch (VaultException e) {
153175
throw new VaultEncryptionConfigurationException("Unable to build Vault Encryption Configuration", e);
154176
}

‎encryption-service-vault/src/main/java/com/mx/path/service/facility/security/vault/VaultEncryptionServiceConfiguration.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ public enum AuthenticationType {
2222
private static final AuthenticationType DEFAULT_AUTHENTICATION = AuthenticationType.APPROLE;
2323
private static final String DEFAULT_KEY_NAME = "vault_session";
2424
private static final int DEFAULT_NUM_KEYS_TO_KEEP_COUNT = 1;
25+
private static final boolean DEFAULT_SSL_ENABLED = false;
2526

2627
@ConfigurationField
2728
private boolean enabled = true;
@@ -59,6 +60,9 @@ public enum AuthenticationType {
5960
@ConfigurationField(secret = true)
6061
private String token;
6162

63+
@ConfigurationField(value = "ssl-enabled")
64+
private boolean ssl = DEFAULT_SSL_ENABLED;
65+
6266
@ConfigurationField
6367
private AuthenticationType authentication = DEFAULT_AUTHENTICATION;
6468
}

‎encryption-service-vault/src/test/groovy/com/mx/path/service/facility/security/vault/VaultEncryptionServiceTest.groovy‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,20 @@ class VaultEncryptionServiceTest extends Specification {
7272
}
7373
}
7474

75+
def configWithAppRoleSSL() {
76+
return new VaultEncryptionServiceConfiguration().tap {
77+
setUri("http://localhost:8200")
78+
setEnabled(true)
79+
setAuthentication(VaultEncryptionServiceConfiguration.AuthenticationType.APPROLE)
80+
setAppRole("role-k8s")
81+
setSecretId("secretId")
82+
setKeyName("test-key")
83+
setMaxRetries(2)
84+
setNumKeysToKeep(3)
85+
setSsl(true)
86+
}
87+
}
88+
7589
def "on first use, creates and authenticates driver once"() {
7690
given:
7791
def config = configWithAppId()
@@ -113,10 +127,11 @@ class VaultEncryptionServiceTest extends Specification {
113127
driver.getClass() == Vault
114128

115129
where:
116-
config | _
117-
configWithAppId() | _
118-
configWithToken() | _
119-
configWithAppRole() | _
130+
config | _
131+
configWithAppId() | _
132+
configWithToken() | _
133+
configWithAppRole() | _
134+
configWithAppRoleSSL() | _
120135
}
121136

122137
@Unroll

‎store-vault/src/main/java/com/mx/path/service/facility/store/vault/VaultStore.java‎

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import lombok.Getter;
1212
import lombok.Setter;
1313

14+
import com.bettercloud.vault.SslConfig;
1415
import com.bettercloud.vault.Vault;
1516
import com.bettercloud.vault.VaultConfig;
1617
import com.bettercloud.vault.VaultException;
@@ -46,21 +47,42 @@ public VaultStore(@Configuration VaultStoreConfiguration configuration) {
4647
*/
4748
Vault buildVaultDriver(@Nullable String authToken) {
4849
try {
49-
VaultConfig vaultConfig = new VaultConfig()
50-
.token(authToken)
51-
.engineVersion(getConfiguration().getEngineVersion())
52-
.address(getConfiguration().getUri())
53-
.build();
54-
55-
Vault newDriver = new Vault(vaultConfig);
56-
57-
if (getConfiguration().getMaxRetries() > 0) {
58-
newDriver.withRetries(
59-
getConfiguration().getMaxRetries(),
60-
Math.toIntExact(getConfiguration().getRetryInterval().toMillis()));
61-
}
50+
if (configuration.isSsl()) { // If SSL is enabled, set up the SSL configuration
51+
SslConfig sslConfig = new SslConfig();
52+
sslConfig.verify(false);
53+
VaultConfig vaultConfig = new VaultConfig()
54+
.sslConfig(sslConfig)
55+
.token(authToken)
56+
.engineVersion(configuration.getEngineVersion())
57+
.address(configuration.getUri())
58+
.build();
59+
60+
Vault newDriver = new Vault(vaultConfig);
61+
62+
if (configuration.getMaxRetries() > 0) {
63+
newDriver.withRetries(
64+
configuration.getMaxRetries(),
65+
Math.toIntExact(configuration.getRetryInterval().toMillis()));
66+
}
67+
68+
return newDriver;
69+
} else {
70+
VaultConfig vaultConfig = new VaultConfig()
71+
.token(authToken)
72+
.engineVersion(getConfiguration().getEngineVersion())
73+
.address(getConfiguration().getUri())
74+
.build();
75+
76+
Vault newDriver = new Vault(vaultConfig);
6277

63-
return newDriver;
78+
if (getConfiguration().getMaxRetries() > 0) {
79+
newDriver.withRetries(
80+
getConfiguration().getMaxRetries(),
81+
Math.toIntExact(getConfiguration().getRetryInterval().toMillis()));
82+
}
83+
84+
return newDriver;
85+
}
6486
} catch (Exception e) {
6587
throw new VaultStoreConfigurationException("Unable to build Vault Configuration", e);
6688
}

‎store-vault/src/main/java/com/mx/path/service/facility/store/vault/VaultStoreConfiguration.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ enum AuthenticationType {
2626
private static final Duration DEFAULT_RETRY_INTERVAL = Duration.ofMillis(200);
2727
private static final int KEY_NOT_FOUND = 404;
2828
private static final int MAXIMUM_REAUTHENTICATION_RETRIES = 3;
29+
private static final boolean DEFAULT_SSL_ENABLED = false;
2930

3031
@ConfigurationField(value = "app-id")
3132
private String appId;
@@ -48,6 +49,9 @@ enum AuthenticationType {
4849
@ConfigurationField(secret = true)
4950
private String secretId;
5051

52+
@ConfigurationField(value = "ssl-enabled")
53+
private boolean ssl = DEFAULT_SSL_ENABLED;
54+
5155
@ConfigurationField(secret = true)
5256
private String token;
5357

‎store-vault/src/test/groovy/com/mx/path/service/facility/store/vault/VaultStoreTest.groovy‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,17 @@ class VaultStoreTest extends Specification {
6262
}
6363
}
6464

65+
def configWithAppRoleSSL() {
66+
return new VaultStoreConfiguration().tap {
67+
setUri("http://localhost:8200")
68+
setAuthentication(VaultStoreConfiguration.AuthenticationType.APPROLE)
69+
setAppRole("role-k8s")
70+
setSecretId("secretId")
71+
setMaxRetries(2)
72+
setSsl(true)
73+
}
74+
}
75+
6576
def "on first use, creates and authenticates driver once"() {
6677
given:
6778
def config = configWithAppId()
@@ -103,10 +114,11 @@ class VaultStoreTest extends Specification {
103114
driver.getClass() == Vault
104115

105116
where:
106-
config | _
107-
configWithAppId() | _
108-
configWithToken() | _
109-
configWithAppRole() | _
117+
config | _
118+
configWithAppId() | _
119+
configWithToken() | _
120+
configWithAppRole() | _
121+
configWithAppRoleSSL() | _
110122
}
111123

112124
def "buildVaultDriver with invalid configuration"() {

0 commit comments

Comments
 (0)